Papers

Field

Top tools here

Open problems in Anomaly detectors

Lack of strong deep representations for tabular anomaly detection1 paper raises it · 1 addresses it
Deep features underperform on tabular data due to weak or unavailable representations, limiting anomaly detection effectiveness.
- Adapting prior-data fitted networks for tabular anomaly detectionraises · addresses
Handling heterogeneous and misaligned multimodal data in anomaly detection2 papers raise it · 2 address it
Real-world systems produce multimodal data with semantic gaps and asynchronous dependencies, making robust anomaly detection difficult.
- Physical-Variable-Informed Deep Learning for Robust Diagnosis in Industrial Fluid Transport Systemsraises · addresses
- BEACON: Bridging Multimodal Semantics and Asynchronous Propagation for Cloud System Anomaly Detectionraises · addresses
Cross-node adversarial transferability in edge-deployed models2 papers raise it · 2 address it
Compromised edge devices can expose models, enabling adversarial attacks that transfer across other devices sharing the same model.
- Model Exposure on One Device Endangers Others: Rethinking Edge Neural Network Security across Devicesraises · addresses
- Mind Your Boundaries: Boundary-Aware Model Obfuscation against Cross-node Attackraises · addresses
Class imbalance and camouflaged fraud in financial anomaly detection1 paper raises it · 1 addresses it
Fraudulent transactions are rare and often disguised, making them hard to detect with standard methods.
- RGH-GNN : Risk-Gated Heterogeneous Graph Neural Network for Financial Fraud Detectionraises · addresses
Robustness to network traffic anomalies in IoT device fingerprinting1 paper raises it · 1 addresses it
Real-world IoT traffic is variable, and anomalies like packet drops or reordering degrade fingerprinting accuracy.
- Robust Lightweight IoT Device Fingerprinting Under Network Traffic Anomaliesraises · addresses

Named by an AI from these papers' abstracts.

Open problems

Recently funded

Topics in this field

adversarial · based intrusion detection · network intrusion82 papers17 this week
anomaly detectors · anomaly detection · series anomaly detection113 papers10 this week

Topics in this field

Active contributors · 90 days

Active contributors

Activity · 12 weeks

Coming with more sources: repos

Activity

Recent papers

All in Research →

arXiv cs.CRSep 22
HYDRA: Proactive Android Malware Drift Adaptation via Hierarchical Graph Contrastive Learning
Han Chen, Hanchen Wang, Hongmei Chen, Lu Qin, Wenjie Zhang +1
Concept drift, driven by the rapid evolution of Android malware, severely degrades the performance of machine learning detectors. Current adaptation strategies are often reactive, responding only after performance has dropped and imposing a significant manual annotation burden, or they are proactive but rely on unstable adversarial training and incomplete, single-level graph representations. To overcome these limitations, we propose HYDRA (Hybrid Drift Adaptation), a proactive adaptation framework that learns drift-invariant representations from hierarchically structured data. HYDRA first models applications using a hybrid graph structure, combining fine-grained Control Flow Graphs (CFGs) and coarse-grained Function Call Graphs (FCGs) to capture comprehensive behavioral patterns. It then introduces a novel cross-domain contrastive learning objective that aligns historical (source) and new (target) data distributions. By generating pseudo-labels for unlabeled target samples, our method pulls representations of semantically similar applications together, regardless of their domain, within a single, stable optimization process. This approach unifies feature learning and domain…
PDF arXiv
arXiv cs.CVSep 22
AT3D-AD: Anomaly Type-Aware 3D Anomaly Detection via Hierarchical Point-Language Alignment
Jingyu Zeng, Haoquan Lu, Can Gao
Detecting and localizing 3D point-cloud defects is essential for industrial inspection. However, existing methods often suffer from imprecise localization due to the lack of anomaly supervision and reliance on single-granularity representations. To address these limitations, we propose Anomaly Type-Aware 3D Anomaly Detection (AT3D-AD), a unified framework for joint detection, localization, and classification. Specifically, we first design the Physics-Driven Parametric Anomaly Synthesis (PDPAS) module employing multiple parametric functions to generate synthetic anomalies, providing explicit anomaly supervision. Then, we propose the Hierarchical Global-Local Anomaly Alignment (HiGLA) module to align global and local representations within the normal and anomalous groups. Finally, we propose the Semantic-Geometric Anomaly Classification (SGAC) module to jointly learn localization and classification, yielding spatially precise and type-discriminative anomaly representations. Extensive experiments establish new state-of-the-art performance on all four benchmarks. AT3D-AD achieves Object/Point AUROC scores of 98.1\%/98.9\% on Anomaly-ShapeNet and 95.0\%/95.2\% on Real3D-AD, while…
PDF arXiv
arXiv cs.CVSep 22
When Point Clouds Outperform Pixels: Rethinking Zero-Shot Multimodal Anomaly Detection
Chenglin Ye, Lupeng Liu, Dongbo Yu, Jun Xiao, Yunbiao Wang
Zero-shot multimodal anomaly detection commonly assumes that RGB and point cloud modalities are equally reliable and can contribute uniformly to anomaly localization. We challenge this assumption. Using a set of recently proposed stringent metrics that penalize false anomaly responses in normal regions, we find that point clouds are substantially more reliable than RGB under zero-shot category shift. Motivated by this observation, we propose WOOPS (\textbf{W}hen P\textbf{o}int Cl\textbf{o}uds Out\textbf{p}erform Pixel\textbf{s}), a reliability-aware zero-shot multimodal anomaly detection framework. To strengthen the more reliable geometric modality, we design a Multi-view Information Decoupling module to suppress heterogeneous information from multi-view point cloud projections and enhance point cloud feature quality. To avoid unconditional fusion, we further introduce a Modality Reliability Calibration module to adaptively calibrate modality contributions according to their reliability. Extensive experiments show that our method achieves the best or competitive performance under the new metrics in both unimodal and multimodal settings. Further analysis demonstrates that point…
PDF arXiv
arXiv cs.CRSep 21
Trust in Edge-Enabled IoT Security: Features, Challenges and Research Directions
Esin Ece Aydın, Şerif Bahtiyar, Gürkan Gür
Providing autonomous intelligence, pervasive connectivity and usability to human life and industry has led to the emergence of the Internet of Things (IoT). To support time-sensitive and resource-constrained applications, IoT systems nowadays increasingly rely on edge computing. This brings computation and decision-making closer to end devices. In edge-enabled IoT architecture, latency and communication overhead are reduced, but interactions among a larger and more diverse set of devices, edge nodes, services, and data sources are introduced as well. In such environments, security and privacy mechanisms provide the foundation for protection, while trust management can assess the reliability of interacting entities and adapting secure decisions. In this paper, we systematically review the current state of trust management in edge-enabled IoT. To this end, we propose a comprehensive taxonomy that maps physical, network, and application architectural IoT layers against the consumer, commercial, industrial, and infrastructure IoT domains. We further investigate state-of-art research based on their trust design, how trust integrated into secure IoT operations, the attacks that effect…
PDF arXiv
arXiv stat.MLSep 21
Empirical Auditing of Edge-Private Graph Generators
Anum Fatima, Stratis Limnios, James Adams, Lukasz Szpruch, Carsten Maple +2
We empirically audit privacy leakage by testing whether outputs from edge-neighbouring inputs remain distinguishable, using statistically valid lower bounds on the privacy loss witnessed by our attacks. Our framework compares direct-edge, local-structural, and GNN-based attacks through the geometry surrounding a target edge. Experiments across two generators and two networks show that privacy leakage is both mechanism- and network-dependent, with learned representations revealing information not captured by conventional local statistics.
PDF arXiv
arXiv cs.CRSep 21
Temporal Generalization and Explanation Stability of Control Flow Graph Neural Networks for Malware Detection
Md. Asif Sajeed, Md. Nazrul Islam Mondal, Md Ashraful Hossen Akash
Malware detection is a critical task in cybersecurity, and graph neural networks over control flow graphs have shown promising results for it. However, detectors are usually evaluated on a random split of a corpus collected over a single period, which cannot show how well a model generalizes to later samples. This study addresses that limitation with a strict temporal split: every model is trained on one period and scored once on a later one. Two corpora of control flow graphs, each node carrying 37 features, were extracted statically from 1,989 Windows portable executables: 459 graphs from 2024-2025 for training and 223 from 2026 for evaluation. Twelve variants and a flat-feature control were trained on the earlier corpus. The choice of message-passing operator changes robustness to the shift significantly, and every pairwise gap that survives correction separates an aggregating architecture from one built around a learned attentional readout. The ranking also reverses: the flat control, which sees node features but no topology, is the best in-distribution model and among the worst across the boundary, so a conventional benchmark would have rejected message passing. Neither…
PDF arXiv

Papers

Topics in this field

adversarial · based intrusion detection · network intrusion82 papers17 this week
anomaly detectors · anomaly detection · series anomaly detection113 papers10 this week

Recent papers

All in Research →

arXiv cs.CRSep 22
HYDRA: Proactive Android Malware Drift Adaptation via Hierarchical Graph Contrastive Learning
Han Chen, Hanchen Wang, Hongmei Chen, Lu Qin, Wenjie Zhang +1
Concept drift, driven by the rapid evolution of Android malware, severely degrades the performance of machine learning detectors. Current adaptation strategies are often reactive, responding only after performance has dropped and imposing a significant manual annotation burden, or they are proactive but rely on unstable adversarial training and incomplete, single-level graph representations. To overcome these limitations, we propose HYDRA (Hybrid Drift Adaptation), a proactive adaptation framework that learns drift-invariant representations from hierarchically structured data. HYDRA first models applications using a hybrid graph structure, combining fine-grained Control Flow Graphs (CFGs) and coarse-grained Function Call Graphs (FCGs) to capture comprehensive behavioral patterns. It then introduces a novel cross-domain contrastive learning objective that aligns historical (source) and new (target) data distributions. By generating pseudo-labels for unlabeled target samples, our method pulls representations of semantically similar applications together, regardless of their domain, within a single, stable optimization process. This approach unifies feature learning and domain…
PDF arXiv
arXiv cs.CVSep 22
AT3D-AD: Anomaly Type-Aware 3D Anomaly Detection via Hierarchical Point-Language Alignment
Jingyu Zeng, Haoquan Lu, Can Gao
Detecting and localizing 3D point-cloud defects is essential for industrial inspection. However, existing methods often suffer from imprecise localization due to the lack of anomaly supervision and reliance on single-granularity representations. To address these limitations, we propose Anomaly Type-Aware 3D Anomaly Detection (AT3D-AD), a unified framework for joint detection, localization, and classification. Specifically, we first design the Physics-Driven Parametric Anomaly Synthesis (PDPAS) module employing multiple parametric functions to generate synthetic anomalies, providing explicit anomaly supervision. Then, we propose the Hierarchical Global-Local Anomaly Alignment (HiGLA) module to align global and local representations within the normal and anomalous groups. Finally, we propose the Semantic-Geometric Anomaly Classification (SGAC) module to jointly learn localization and classification, yielding spatially precise and type-discriminative anomaly representations. Extensive experiments establish new state-of-the-art performance on all four benchmarks. AT3D-AD achieves Object/Point AUROC scores of 98.1\%/98.9\% on Anomaly-ShapeNet and 95.0\%/95.2\% on Real3D-AD, while…
PDF arXiv
arXiv cs.CVSep 22
When Point Clouds Outperform Pixels: Rethinking Zero-Shot Multimodal Anomaly Detection
Chenglin Ye, Lupeng Liu, Dongbo Yu, Jun Xiao, Yunbiao Wang
Zero-shot multimodal anomaly detection commonly assumes that RGB and point cloud modalities are equally reliable and can contribute uniformly to anomaly localization. We challenge this assumption. Using a set of recently proposed stringent metrics that penalize false anomaly responses in normal regions, we find that point clouds are substantially more reliable than RGB under zero-shot category shift. Motivated by this observation, we propose WOOPS (\textbf{W}hen P\textbf{o}int Cl\textbf{o}uds Out\textbf{p}erform Pixel\textbf{s}), a reliability-aware zero-shot multimodal anomaly detection framework. To strengthen the more reliable geometric modality, we design a Multi-view Information Decoupling module to suppress heterogeneous information from multi-view point cloud projections and enhance point cloud feature quality. To avoid unconditional fusion, we further introduce a Modality Reliability Calibration module to adaptively calibrate modality contributions according to their reliability. Extensive experiments show that our method achieves the best or competitive performance under the new metrics in both unimodal and multimodal settings. Further analysis demonstrates that point…
PDF arXiv
arXiv cs.CRSep 21
Trust in Edge-Enabled IoT Security: Features, Challenges and Research Directions
Esin Ece Aydın, Şerif Bahtiyar, Gürkan Gür
Providing autonomous intelligence, pervasive connectivity and usability to human life and industry has led to the emergence of the Internet of Things (IoT). To support time-sensitive and resource-constrained applications, IoT systems nowadays increasingly rely on edge computing. This brings computation and decision-making closer to end devices. In edge-enabled IoT architecture, latency and communication overhead are reduced, but interactions among a larger and more diverse set of devices, edge nodes, services, and data sources are introduced as well. In such environments, security and privacy mechanisms provide the foundation for protection, while trust management can assess the reliability of interacting entities and adapting secure decisions. In this paper, we systematically review the current state of trust management in edge-enabled IoT. To this end, we propose a comprehensive taxonomy that maps physical, network, and application architectural IoT layers against the consumer, commercial, industrial, and infrastructure IoT domains. We further investigate state-of-art research based on their trust design, how trust integrated into secure IoT operations, the attacks that effect…
PDF arXiv
arXiv stat.MLSep 21
Empirical Auditing of Edge-Private Graph Generators
Anum Fatima, Stratis Limnios, James Adams, Lukasz Szpruch, Carsten Maple +2
We empirically audit privacy leakage by testing whether outputs from edge-neighbouring inputs remain distinguishable, using statistically valid lower bounds on the privacy loss witnessed by our attacks. Our framework compares direct-edge, local-structural, and GNN-based attacks through the geometry surrounding a target edge. Experiments across two generators and two networks show that privacy leakage is both mechanism- and network-dependent, with learned representations revealing information not captured by conventional local statistics.
PDF arXiv
arXiv cs.CRSep 21
Temporal Generalization and Explanation Stability of Control Flow Graph Neural Networks for Malware Detection
Md. Asif Sajeed, Md. Nazrul Islam Mondal, Md Ashraful Hossen Akash
Malware detection is a critical task in cybersecurity, and graph neural networks over control flow graphs have shown promising results for it. However, detectors are usually evaluated on a random split of a corpus collected over a single period, which cannot show how well a model generalizes to later samples. This study addresses that limitation with a strict temporal split: every model is trained on one period and scored once on a later one. Two corpora of control flow graphs, each node carrying 37 features, were extracted statically from 1,989 Windows portable executables: 459 graphs from 2024-2025 for training and 223 from 2026 for evaluation. Twelve variants and a flat-feature control were trained on the earlier corpus. The choice of message-passing operator changes robustness to the shift significantly, and every pairwise gap that survives correction separates an aggregating architecture from one built around a learned attentional readout. The ranking also reverses: the flat control, which sees node features but no topology, is the best in-distribution model and among the worst across the boundary, so a conventional benchmark would have rejected message passing. Neither…
PDF arXiv

Active contributors · 90 days

Activity · 12 weeks

Coming with more sources: repos

Fields · AI · updated 3m ago

Anomaly detectors

Found by the topic model: anomaly detectors, adversarial.

27papers this week−37.2% vs last week

All papers · 195 With code · 1

Newest Most relevant

176 papers this month

Open problems in Anomaly detectors

Lack of strong deep representations for tabular anomaly detection1 paper raises it · 1 addresses it
Deep features underperform on tabular data due to weak or unavailable representations, limiting anomaly detection effectiveness.
- Adapting prior-data fitted networks for tabular anomaly detectionraises · addresses
Handling heterogeneous and misaligned multimodal data in anomaly detection2 papers raise it · 2 address it
Real-world systems produce multimodal data with semantic gaps and asynchronous dependencies, making robust anomaly detection difficult.
- Physical-Variable-Informed Deep Learning for Robust Diagnosis in Industrial Fluid Transport Systemsraises · addresses
- BEACON: Bridging Multimodal Semantics and Asynchronous Propagation for Cloud System Anomaly Detectionraises · addresses
Cross-node adversarial transferability in edge-deployed models2 papers raise it · 2 address it
Compromised edge devices can expose models, enabling adversarial attacks that transfer across other devices sharing the same model.
- Model Exposure on One Device Endangers Others: Rethinking Edge Neural Network Security across Devicesraises · addresses
- Mind Your Boundaries: Boundary-Aware Model Obfuscation against Cross-node Attackraises · addresses
Class imbalance and camouflaged fraud in financial anomaly detection1 paper raises it · 1 addresses it
Fraudulent transactions are rare and often disguised, making them hard to detect with standard methods.
- RGH-GNN : Risk-Gated Heterogeneous Graph Neural Network for Financial Fraud Detectionraises · addresses
Robustness to network traffic anomalies in IoT device fingerprinting1 paper raises it · 1 addresses it
Real-world IoT traffic is variable, and anomalies like packet drops or reordering degrade fingerprinting accuracy.
- Robust Lightweight IoT Device Fingerprinting Under Network Traffic Anomaliesraises · addresses

Named by an AI from these papers' abstracts.